WebPros SolusVM 2: Server-side template injection leads to remote code execution
Summary
SolusVM 2 up to version 2.0.0-44576 contains a server-side template injection vulnerability (CWE-1336). A remote attacker with valid user credentials can execute arbitrary code with root privileges on the server. According to the vendor, a compromise could extend to the management node and to other customers hosted on the same node.
Affected
- SolusVM 2, all versions up to and including 2.0.0-44576
Fixed in
- Vendor-listed patched version: 2.0.0-44739 (availability not confirmed at time of writing)
Workaround
- Unknown. The vendor advisory lists no workaround.
- Restricting access to the SolusVM panels to management networks or VPN reduces exposure but is not a vendor-verified fix.
Exploitation
- No evidence of exploitation in the wild found.
- CISA SSVC (Vulnrichment): Exploitation none, Automatable no, Technical Impact total.
- No public proof-of-concept found; the vendor and VulDB state that technical details are not publicly available.
Our recommendation
- Inventory all SolusVM 2 instances and check whether their version is 2.0.0-44576 or earlier.
- Ask WebPros for the release date and download location of 2.0.0-44739 and patch as soon as it is available.
- Until patched, restrict panel access to management networks or VPN and review user accounts.
- Monitor authentication and administrative activity.
- Hosting customers should ask their provider whether it runs affected versions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WebPros SolusVM 2 security advisory support.solusvm.com
- VulDB entry vuldb.com
- OpenCVE entry app.opencve.io
- Strix CVE record www.strix.ai
- CNNVD record via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:01.
Original description (NVD)
A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.